diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml
index 2e1960e..b8d8eed 100644
--- a/.github/actions/build/action.yml
+++ b/.github/actions/build/action.yml
@@ -14,6 +14,14 @@ inputs:
     description: "Upstream ref to build"
     type: string
     required: true
+  cache-scope:
+    description: "GHA cache scope for layer caching (empty to disable)"
+    type: string
+    required: false
+  cache-fallback-scope:
+    description: "Additional GHA cache scope to read from as fallback"
+    type: string
+    required: false
 
 outputs:
   repos:
@@ -55,6 +63,8 @@ runs:
         LABEL: ${{ inputs.label }}
         REPOS: ${{ inputs.repos }}
         REPOSITORY_NAME: ${{ github.repository }}
+        CACHE_SCOPE: ${{ inputs.cache-scope }}
+        CACHE_FALLBACK_SCOPE: ${{ inputs.cache-fallback-scope }}
       run: |
         tags=()
         base_tag="${UPSTREAM_REF}${LABEL:+-$LABEL}"
@@ -87,6 +97,17 @@ runs:
 
         crawl_tag="${UPSTREAM_REF#v}"
 
+        cache_from=""
+        cache_to=""
+        if [[ -n "${CACHE_SCOPE:-}" ]]; then
+          cache_from="type=gha,scope=${CACHE_SCOPE}"
+          cache_to="type=gha,mode=max,scope=${CACHE_SCOPE}"
+        fi
+        if [[ -n "${CACHE_FALLBACK_SCOPE:-}" ]]; then
+          NL=$'\n'
+          cache_from="${cache_from:+${cache_from}${NL}}type=gha,scope=${CACHE_FALLBACK_SCOPE}"
+        fi
+
         {
           printf 'crawl-tag=%s\n' "${crawl_tag}"
           printf 'tags<<EOF\n%s\nEOF\n' "$(printf '%s\n' "${tags[@]}")"
@@ -94,12 +115,12 @@ runs:
           printf 'repos<<EOF\n%s\nEOF\n' "$(printf '%s\n' "${repo_list[@]}")"
           printf 'primary-tag=%s\n' "${base_tag}"
           printf 'primary-ref=%s\n' "${primary_ref}"
+          printf 'cache-from<<EOF\n%s\nEOF\n' "${cache_from}"
+          printf 'cache-to=%s\n' "${cache_to}"
         } >> "$GITHUB_OUTPUT"
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
-      with:
-        driver: docker
 
     - name: Build image
       id: build
@@ -111,3 +132,5 @@ runs:
         build-args: |
           CRAWL_TAG=${{ steps.compute.outputs.crawl-tag }}
         tags: ${{ steps.compute.outputs.refs }}
+        cache-from: ${{ steps.compute.outputs.cache-from }}
+        cache-to: ${{ steps.compute.outputs.cache-to }}
diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml
index fad03f7..a48aec3 100644
--- a/.github/workflows/build-and-publish.yml
+++ b/.github/workflows/build-and-publish.yml
@@ -31,6 +31,7 @@ jobs:
             docker.io/treyturner/dcss
             forgejo.treyturner.info/treyturner/dcss
           upstream-ref: v${{ inputs.upstream-ref && inputs.upstream-ref || env.CRAWL_TAG }}
+          cache-scope: main
 
       - name: Test
         uses: ./.github/actions/test
diff --git a/.github/workflows/build-and-test-pr.yml b/.github/workflows/build-and-test-pr.yml
index 8aaa687..1f5af12 100644
--- a/.github/workflows/build-and-test-pr.yml
+++ b/.github/workflows/build-and-test-pr.yml
@@ -21,6 +21,8 @@ jobs:
         with:
           label: ${{ format('pr{0}', github.event.pull_request.number) }}
           upstream-ref: v${{ env.CRAWL_TAG }}
+          cache-scope: ${{ github.head_ref }}
+          cache-fallback-scope: main
 
       - name: Test
         uses: ./.github/actions/test
diff --git a/Dockerfile b/Dockerfile
index 2b06ff7..d4727c3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1.7
+
 ARG CRAWL_TAG=0.34.0
 
 ###########
@@ -9,7 +11,9 @@ FROM python:3.13-alpine AS builder
 ARG CRAWL_TAG \
     CRAWL_REPO=https://github.com/crawl/crawl
 
-RUN apk add --no-cache \
+RUN --mount=type=cache,target=/var/cache/apk \
+    --mount=type=cache,target=/root/.cache/pip \
+    apk add \
         g++ \
         gcc \
         git \
@@ -17,7 +21,7 @@ RUN apk add --no-cache \
         make \
         ncurses-dev \
         perl \
-    && pip install --no-cache-dir pyyaml
+    && pip install pyyaml
 
 RUN mkdir /build \
     && cd /build \
@@ -46,8 +50,10 @@ COPY --from=builder /build/crawl/crawl-ref/docs/ /app/docs/
 
 WORKDIR /app/source
 
-RUN apk add --no-cache gcc musl-dev \
-    && pip install --no-cache-dir -r /app/source/webserver/requirements/base.py3.txt
+RUN --mount=type=cache,target=/var/cache/apk \
+    --mount=type=cache,target=/root/.cache/pip \
+    apk add gcc musl-dev \
+    && pip install -r /app/source/webserver/requirements/base.py3.txt
 
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh